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Based on the two-step protocol [Phys. Rev. A68(03)042317], we propose a (n, n)-threshold 

multiparty quantum secret sharing protocol of secure direct communication. In our protocol only 

ly-^ I all the sharers collaborate can the sender's secure direct communication message be extracted. 

. We show a variant version of this protocol based on the variant two-step protocol. This variant 

O . 

, version can considerably reduce the realization difficulty in experiment. In contrast to the use 

(-H I of multi-particle GHZ states in the case that the sharer number is larger than 3, the use and 

^ ' identification of Bell states are enough in our two protocols disregarding completely the sharer 

number, hence, our protocols are more feasible in technique. 



> 



PACS: 03.67.Dd, 03.65.Ta, 89.70.+C 



. Quantum key distribution (QKD) is an ingenious application of quantum mechanics, in which two 

CO , remote legitimate users (Alice and Bob) establish a shared secret key through the transmission of 

\ quantum signals and thereafter they can use this key to encrypt the secret messages or decrypt the 

' encrypted messages. With quantum mechanics, other cryptographic task can be realized, such as 

' quantum secret sharing (QSS). QSS is a generalization of classical secret sharing[l,2] to a quantum 



scenario [3], where the sender's secret message is distributed via quantum mechanical method among 



f-H ■ n sharers in such a way that only all the sharers cooperate can they recover the secret message. The 



QSS is likely to play a key role in protecting secret quantum information, e.g., in secure operations 
of distributed quantum computation, sharing difficult-to-construct ancilla states and joint sharing of 
quantum money [6], and so on. Hence, after the pioneering QSS work proposed by Hillery et al. using 
I three-particle and four-particle GHZ states [3], this kind of works on QSS attracted a great deal of 

' attentions in both theoretical and experimental aspects [4-16,27]. All these works [3-16] can be divided 



into two kinds, one only deals with the QSS of classical messages (i.e., bits)[5-6, 8-11, 13-14, 27], or only 
deals with the QSS of quantum information [4,7,12,15-16] where the secret is an arbitrary unknown 
state in a qubit; and the other [3] studies both, that is, deals with QSS of classical messages and QSS 
of quantum information simultaneously. In all these works [3- 16, 2 7], when the party number is greater 
than 3, multi-particle GHZ states are used with only two exceptions[13,27]. Note that, so far all these 
works dealing with the QSS of classical messages (bits) allow in essence a sender to establish a joint 
key with receivers. 

On the other hand, a novel concept, quantum secure direct communication (QSDC) has been 
proposed and pursued recently[17-20]. Different from QKD whose object is to distribute a common 
key between the two remote legitimate users of communication, QSDC can transit the secret messages 
directly without creating first a key to encrypt them. Hence, QSDC may be important in some 
applications which have been shown by Bostrom et aZ.[18] and Deng et aZ. [19-20]. 

Our one basic purpose in this paper is to generalize the concept of usual multiparty quantum 
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secret sharing of key to the counterpart concept of muhiparty quantum secret sharing of secure 
direct communication. As same as the advantages of QSDCs over QKDs. the advantages of such 
a generahzation are intuitive. Based on a QSDC protocol (i.e., the two-step protocol) proposed by 
Deng et al.[19] using Einstein-Podolsky- Rosen (EPR) photon pair block, in this paper we will propose 
a multiparty quantum secret sharing protocol of secure direct communication. In our this protocol, 
only all the sharers collaborate can the secure direct communication message be obtained by all the 
sharers. Moreover, we will show a variant version of this protocol based on the variant two-step 
protocol we will propose. This variant version can considerably reduce the realization difficulty in 
experiment. In contrast to the use of multi-particle GHZ states in the case that the sharer number is 
larger than 3, the use and identification of Bell states are enough in our two protocols disregarding 
completely the sharer number, hence, our protocols are more feasible in technique. One will see these 
later. 

Now let us turn to our multiparty quantum secret sharing (QSS) protocol of secure direct commu- 
nication. For convenience, let us first describe a three-party protocol. Suppose Alice has a (27V)-bit 
secret message. She wants to send this secret message to two distant sharers. Bob and Charlie. One 
of them. Bob or Charlie, is not entirely trusted by Alice, and she knows that if the two guys coexist, 
the honest one will keep the dishonest one from doing any damages. The two sharers can infer the 
secret message only by their mutual assistance. Our following three-party QSS protocol of secure 
direct communication can achieve this goal with 7 steps. 

(a) All the parties (Alice and the two sharers Bob and Charlie) agree on that each of the four Bell 
states can carry a two-bit classical message, i.e., f/)"*", </>", ip'^ and 'ip~ correspond to 00, 01, 10 and 11, 
respectively. Here the four Bell states are defined as follows: 

0+ = (|0)|0) + |1)|1))/V2 = {\H)\H) + \V)\V))/V2, (1) 



r = (|0)|0) - |1)|1))/V2 = {\H)\V) + \V)\H))/V2, (2) 
V+ = (|1)|0) + |0)|l))/y2 = i\H}\H} - \V}\V})/^/2, (3) 

i>- = (|1)|0) - |0)|l))/^/2 = {\V)\H) - \H)\V))/^/2, (4) 

where |0) and |1) are the up and down eigenstates of a^, \H) = (|0) |1))/V2 and \V) = (|0)-|1))/V2 
are the up and down eigenstates of ax- For convenience, {|0),|1)} is refereed to as the diagonal basis 
and the rectilinear basis hereafter. 

(b) First Alice prepares an ordered N EPR photon pair sequence according to her secret message. 
Then she prepares k + j EPR photon pairs each randomly in one of the four Bell states. We call 
these photon pairs as checking photon pairs. Alice randomly inserts each of the k + j checking 
photon pairs one by one into the ordered N photon pair sequence and records each position. We 
denote the ordered N + k + j EPR pair sequence with [(Xi, li), {X2, Y2),. . . , {Xj^f+k+j ,YN+k+j)]- 
Here the subscript indicates the pair order in the sequence, and X and Y represent the two photons, 
respectively. 

(c) Alice takes one photon from each EPR pair to form an ordered photon sequence, say, 
[Yi, Y2, . . . , Y^^k+j]- It is called the Y sequence. The remaining EPR partner photons form another 
ordered sequence [Xi,X2, ■ ■ ■ ,X7v+/c+j]- It is called the X sequence. Alice sends the Y sequence to 
Bob. 
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(d) After he receives the Y sequence, for each photon in the sequence Bob randomly chooses a local 
unitary operation from Ui, U2, U3, and H and performs this operation on it. After his encryptions 



(i.e., the local unitary operations). Bob sends the ordered Y photons to Charlie. Here 

i/i = |0)(0| + |l)(l|=/, (5) 

C/2 = |0)(0|-|l)(l|=a„ (6) 

[/3 = |0)(l| + |l)(0| = a„ (7) 

;74=|0)(l|-|l)(0|=ia^, (8) 

H = (|0)(0| - + |0)(1| + |l)(0|)/^/2 = (C/2 + Us)/V2 = {a, + a,)/V2, (9) 
where H is the so-called Hadamard operator. Define 

C = (r + V'+)/^/2 = miO) - \V)\1))/V2 = {\0)\H) + \1)\V))/V2, (10) 

r? ^ (<^+ - ^-)/V2 = {\Vm + \H)\1))/V2 = m\H) - \1)\V))/V2, (11) 

X = (^- + <^+)/V2 = {\H)\0) - \V)\1))/V2 = m\V) + \m))/V2, (12) 

C = (V+ - r )/V^ = (-IV^)IO) + \H)\1})/V2 = i-mV) + \1)\H))/V2. (13) 



For convenience, {(j)'^, 4>~ , ip~^, tp~} is refereed to as the Bell state set and r], x, Q the rotation 
state set hereafter. The nice feature of the Ui{i — 1,4) operation is that it transforms the state in both 
state sets (cf., Table 1 and Table 2). In contrast, the nice feature of H is that it can realize the state 
transformation between the two sets (cf.. Table 1 and Table 2). The purpose of choosing a set of five 
unitary operations is to protect the channel between Alice and Bob from Charlie's interception. For 
example, if Bob chooses randomly a unitary operation from only Ui{i = 1,4), Charlie could intercept 
the channel between Alice and Bob and replaces the Y sequence by a fake one. Then when Bob sends 
the encrypted fake Y sequence to Charlie, Charlie can know Bob's encryptions (i.e.. his Ui{i = 1,4) 
operations) by Bell-state measurements on his fake pair sequence. Since Charlie has already had all 
the information about Bob's encryptions, he can perform the same encryptions as Bob did on his 
intercepted Y sequence and accordingly he can readily retrieve the complete message without Bob's 
help. 

Table 1 Results of four Bell states after the 11^ , U2 , , and Hy unitary operations. See text 



for details. 
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Table 2 Results of the $,xy, Vxy, Xxy and Cxy states after the 1/^ , Uj, Uj, Uj and Hy unitary 

operations. See text for details. 
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(e) After confirniing that Bob has received an ordered Y sequence, Alice publicly announces the 
positions of k checking photon pairs. For each of these k checking photon pairs, Alice first lets Charlie 

measure the corresponding checking photon in his lab by using the diagonal basis or the rectilinear 
basis and publish his measurement outcome. Alice's choice of letting Charlie use which basis is 
completely random. Then Alice lets Bob publish which unitary operation he has performed on the 
checking photon when it passes by him. If Bob's unitary operation is H, then Alice measures the 
corresponding checking photon in her lab by using the different basis from the one she let Charlie 
use. Otherwise, she measures the photon using the same basis as Charlie used. By the way, if only 
one basis is used, then Eve can steal secret information without being detected. Since only Alice 
knows the initial state of each checking photon pair, after all her measurements, she can determine 
the error rate according to the correlations (cf., equations 1-4 and 10-13). If the error rate exceeds 
the threshold, the process is aborted. Otherwise, the process continues and Alice sends the retained 
N + j ordered sequence to Charlie. 

(f) After Charlie receives the photons, if Bob and Charlie collaborate, both Bob and Charlie can 
obtain a raw secret message including Alice's secret message and additional 2j useless bits. The 
detailed procedure is as follows. For each photon pair, if Bob's unitary operation is Ui{i = 1,4), 
then Bob and Charlie directly perform a Bell-state measurement on the photon pair. If Bob's unitary 
operation is H, then they first perform a Hardamard operation on the Y photon and then perform 
a Bell-state measurement on the photon pair. According to their measurement outcome and Bob's 
exact unitary operation they can deduce the two secret bits Alice imposed on this photon pair. For 
example, without loss of generality, suppose their outcome is ijj^ . If Bob's unitary operation is U3, 
then according to Table 1 they can infer that the secret bits Alice imposed on this photon pair is '01' 
corresponding to the initial state if Bob's unitary operation is H, they can infer that the secret 
bits Alice imposed on this photon pair is '11' corresponding to the initial state tp~ . On the other 
hand, if Bob and Charlie do not collaborate, then neither of them can get access to Alice's secret 
message with 100% certainty. 

(g) Alice publicly announces the initial states and positions of the retained j checking pairs for Bob 
and Charlie to extract her exact secret message from the raw secret message and to check whether 
the N + j X photons travelling from Alice site to Charlie's site have been attacked, which is called 
message authentification. Even if the photons are attacked, the eavesdropper Eve can not get access 
to any useful information but interrupt the transmissions quantum channel between Alice and the 
last receiver (Charlie). 

So far we have proposed the three-party QSS protocol of secure direct communication based on Deng 
et al.^s two-step QSDC protocol[19] by using the EPR photon pair block. Its security proof is similar 
to those in Refs. [18-19,21-23] with entangled photons. The proof of our this protocol is based on the 
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security for the transmission of the Y sequence. This is very similar to the security for the transmission 
of the C sequence in the two-step protocol. If Alice, Bob and Charlie could not detect eavesdropper 
Eve in the transmission of the Y sequence, the eavesdropper would adopt the intercept-resend strategy 
to eavesdrop the quantum channel and easily reads out the secure direct communication message. In 
fact, in our protocol Alice, Bob and Charlie can know whether the transmission of the Y sequence is 
secure or not by using the checking procedure based on the qubit correlation of each Bell state and Eve 
will be found out if she eavesdrops the quantum channel. Moreover, even in a worse case that there 
is an insider (Bob or Charlie) who wants to occupy independently the secure direct communication 
without another sharer's help and thereby eavesdrops the quantum line, this insider's eavesdropping 
can be also detected by using the detecting method. Once the security for the transmission of the Y 
sequence is not ensured, Alice will abort the transmission of the X sequence, thereby no information 
will be leaked to the eavesdropper. As same as in the two-step protocol, the transmission and the 
security check of the Y sequence in our this protocol is also very similar to the procedure in BBM92 
QKD protocol[26], where one qubit in an EPR pair is sent to a party and another is sent to another 
party. Here the X sequence is retained securely in Alice's lab and Eve (or an insider) can not get 
access to it at all before Alice's eavesdropping detection. Hence, the security of transmission of the Y 
sequence can be simply reduced to the security of the BBM92 QKD protocol. The proof of security 
for BBM92 in ideal and practical conditions has been given so far[21,23]. Hence our this protocol is 
also unconditionally secure. 

Now let us generalize the three-party QSS protocol of secure direct communication to a n-party 
(n > 4) QSS one. Suppose that Alice is the message sender who would like to send a secret massage 
to Bob, Charlie, Dick, . . . , York and Zach (there is totally n — 1 sharers). Alice does not trust anyone 
but the sharer entirety. She hopes that, only the sharer entirety cooperates can her secure direct 
communication message be obtained by the entirety, otherwise, no one of the entirety can get access 
to her secret message with 100%. Our n-party {n > 4) QSS protocol of secure direct commimication 
can achieve this goal. The first four step and the last step of the n-party (n > 4) QSS protocol of 
secure direct communication is the same as these in the three-party QSS protocol. Therefore, we 
describe the n-party (n > 4) QSS protocol from the step 5. 

(V) After receiving the Y sequence, Charlie encrypts it in the same way as Bob and then sends it 
to the next sharer, say, Dick. Similar procedures are repeated until the (n— l)th sharer Zach receives 
the Y sequence. 

(VI) After confirming that Zach has received the ordered Y sequence, Alice publicly announces 
the positions of k checking photon pairs. For each of these k checking photon pairs, Alice first lets 
Zach measure the corresponding checking photon in his lab by using either the diagonal basis or 
the rectilinear basis and publish his measurement outcome. Alice's choice of letting Zach use which 
basis is completely random. Then Alice lets all other sharers without Zach publish which unitary 
operations they have performed on the checking photon when it passes by them. Since only Alice 
knows the initial state of each checking photon pair, using Table 1 and Table 2 she can works out 
its final state before measurements. If the final state belongs to the rotation state set, then Alice 
measures the corresponding checking photon in her lab by using the different basis from the one she 
has let Zach use. Otherwise, she measures the photon using the same basis as she has let Zach use. 
Similar procedures are repeated until all actions including Zach's measurements and publishes, all 
other sharers' publishes of unitary operations and Alice's unitary operations and measurements are 
completed for the k checking photon pairs. Then Alice can determine the error rate in terms of the 
correlations (cf., equations 1-4 and 10-13). If the error rate exceeds the threshold, the process is 
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aborted. Otherwise, the process continues and Alice sends the retained {N + j) ordered sequence to 
Zach. 

(VII) After Zach receives the photons, if ah the sharers collaborate, then they can obtain a raw 
secret message including Alice's secret message and additional 2j useless bits. The detailed procedure 
is as follows. For each photon pair, they the unitary operation U = U^UqU^ . . . on the Y 
photon, where Ub{Uc,Ud, ■ • ■ , Uz) represents the unitary operation Bob (CharHe, Dick, . . . , York, 
Zach) has ever performed on the Y photon. After this unitary operation, the state of this photon pair 
is recovered to its initial state, thereby all the sharers can take a Bell-state measurement to extract 
Alice's two-bit secret information. After all the photon pairs are dealt with, they can obtain the raw 
secret message. On the other hand, if anyone of all the sharers does not collaborate, then none of 
them can get access to Alice's secret message with 100% certainty. 

(VIII) As mentioned previously, the present last step is same as the counterpart step in the three- 
party QSS protocol of secure direct communication. This step ensures all the sharers to extract Alice's 
exact secret message from the raw secret message and the security of transmission of the {N + j) X 
photons. 

So far we have established a n-party QSS protocol of secure direct communication. Its security is 
the same as the security of three-party QSS protocol of secure direct communication, which is also 
unconditionally secure. 

In our multiparty QSS protocol of secure direct communication, Alice is the preparer of the EPR 
photon pair sequence and the X and Y photon sequences are sent from her by two-steps. Such 
unilateral transmissions determines that when all sharers extract Alice's secret message they should 
perform reversal unitary operations to recover the state of each relative pair to its initial state. It 
is known that the more operations the more difficulties in experiment. In the following we will take 
advantage of the change of transmission to reduce the difficulty in experiment. One will sec this later. 
Suppose Alice has a 2iV-bit secret message. She would like to send a secret massage to Bob, Charlie, 
Dick, . . . , York and Zach (there is totally n — 1 sharers) . Alice does not trust anyone but the entirety. 
She hopes that, only the entirety cooperate can her secure direct communication message be obtained 
by the entirety, otherwise, no one of the entirety can get access to her secret message with 100%. The 
variant version of our this n-party QSS protocol of secure direct communication is depicted as follows. 

(1) All the parties (Alice and all the sharers Bob, Charlie, Dick, . . . , York and Zach) agree on that 
each of the four Bell states can carry a two-bit classical message, i.e., (j)'^, (p~ , and ^~ correspond 
to 00, 01, 10 and 11, respectively. 

(2) Alice lets Zach prepare an ordered N + k + j EPR pair block and initial states of all 
the pairs are in We denote the ordered N + k + j EPR pair sequence is denoted with 

[(-'^l;^!), (-^2, "5^2), ■ • ■ , {XN+k+j,YN+k+j)]- 

(3) Zach takes one photon from each EPR pair to form an ordered photon sequence, say, 
[Yi, I2, • • • , YN+k+j]- It is called the Y sequence. The remaining EPR partner photons form another 
ordered sequence [ATi, X2, . . . , XN+k+j]. It is called the X sequence. Alice sends the Y sequence to 
the (n — 2)th sharer York. 

(4) After he receives the Y sequence, for each photon in the sequence York randomly chooses a 
local unitary operation from Ui, U2, Us, U4 and H and performs this operation on it and then sends 
it to the {n — 3)th sharer. The (n — 3)th sharer encrypts the Y sequence in the same way as York and 
then sends it to the next sharer, an so on. Similar procedures are repeated until the first sharer Bob 
finishes his encryptions. Bob sends the Y sequence to Alice. 

(5) Alice selects randomly k photons and publicly announces their positions in the Y sequence. Alice 
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lets Zach measure the partner photons in the X sequence of the selected photons in the Y sequence 
either in the diagonal basis or in the rectilinear basis. To prevent any sharer's intercept-resend attack, 
for each selected photon, Alice randomly selects a sharer one by one and let him or her tell her this 
sharer's message till she obtains all sharer's messages. Here Zach's message includes which basis he 
has used to measure the partner photon and his measurement outcome, York's (,..., Charlie's, Bob's) 
message is which unitary operation he has ever performed on the selected photon. By the way, such 
random choice is to protect the quantum channel from any sharer's interception. Hence, Alice can 
know via calculation the exact final state of her selected photon should be after Zach's measurement 
on the partner photon, and thereby after her measurements she can determine the error rate. If the 
error rate exceeds the threshold, the process is aborted. Otherwise, the process continues and Alice 
performs unitary operations on the retained photons in the Y sequence to encode a raw secret message 
including her secret messages and additional 2j useless bits. Alice sends these encoded photons to 
Zach. 

(6) After Zach receives the photons, if all the sharers collaborate, then they can obtain a raw secret 
message including Alice's secret message and additional 2j useless bits. The detailed procedure is 
as follows. For each photon pair, they can work out the exact state before Alice's encoding. If it 
belongs to the Bell state set, then they directly take a Bell-state measurement and thereby they can 
know the two bits Alice has ever imposed on this pair. Otherwise, they first perform a Hadamard 
operation on the Y photon and take a Bell-state measurement. From Table 2 they can infer the state 
of this pair before the Hadamard operation and thereby they can know the two bits Alice has ever 
imposed on the pair. Note that after the change of the transmission direction the reversal operations 
are unnecessary anymore during the raw message extraction. To this sense, we think this variant 
version has considerably reduced the realization difficulty in experiment. 

(7) Alice publicly announces positions of the additional j pairs and her encodings for all the sharers 
to extract her exact secret message from the raw secret message and to check whether the (N + 
j) Y photons travelling from Alice site to Charlie's site have been attacked. Even if the photons 
are attacked, the eavesdropper Eve can not get access to any useful information but interrupt the 
transmissions quantum channel between Alice and Zach. 

So far we have presented the variant version of our multiparty QSS protocol of secure direct com- 
munication. It is based on a variant two-step protocol we just proposed. Different from the first 
multiparty QSS protocol where the sender Alice sends the Y and X sequence by two steps and her 
secret message is encoded on the X sequence, in the variant version it is the last sharer Zach who sends 
the Y sequence to fetch the secret message. Such a change of transmissions ensures the realization 
difficulty in experiment can be considerably reduced. As mentioned previously, its security proof is 
also very similar these in Refs. [18-19, 21-23] and can be reduced to the proof of the BBM92 QKD 
protocol[26]. Hence, it is also unconditionally secure. 

In all our present protocols, the multi-particle CHZ states in all other existing multiparty QSS 
schemes are not necessary. Although in [15] it is claimed that only Bell states are needed, the 
identification of multi-particle GHZ state is still necessary. In our multiparty SSQI protocol, only 
the use and identification of Bell states are needed. Till now to our knowledge only five-photon GHZ 
state is realized in experiment [24], more-photon GHZ state is still desired in experiment. Hence, in 
the case when the sharer number is large enough, the usual QSS schemes can only be possible in 
theory. In contrast, for any large number of sharers, our protocols can securely work provided the use 
and identification of Bell states are possible. Hence, the present multiparty QSS protocols are more 
feasible in technique[25]. 



8 



To summarize, in this paper based on the two-step protocol we have presented a multiparty 
quantum secret sharing protocol of secure direct communication. In our protocol only all the sharers 
collaborate can the sender's secure direct communication messages be extracted. We show a variant 
version of this protocol based on the variant two-step protocol. This variant version can considerably 
reduce the realization difficulty in experiment. In contrast to the use of multi-particle GHZ states 
in the case that the sharer number is larger than 3, the use and identification of Bell states are 
enough in our two protocols disregarding completely the sharer number, hence, our protocols are 
more feasible in technique. 
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